bpm-foundation-rate-us@35.3.9

High-risk behavior combination matched malicious policy.

Any runtime require/import of index.js.

Arbitrary native code execution under the importing process user.

remote binary download, temporary-file drop, and detached execution

Loading index.js silently requires _compat.js. Its immediately invoked setup routine fetches a platform-specific executable from rotating obfuscated hosts, or reconstructs one from DNS TXT records. It writes the bytes to a temporary random filename, makes Unix payloads executable, and starts them detached through /bin/sh or cmd.exe. The marker only limits repetition; it does not require user consent or validate a signed payload.

This is concrete runtime remote-code execution, not ordinary telemetry: a minimal adapter imports a hidden loader that retrieves and launches unsigned binaries. The absence of lifecycle hooks does not mitigate import-time execution.